5.8 The Tagging API sweep¶
_collect_tagging_sweep() pages through resourcegroupstaggingapi:GetResources, which returns
every tagged resource of the region (AWS never returns resources that were never tagged). Each
becomes an asset classified by asset_type_from_arn() with discovered_via: "tagging-api" and
service. Its value is enrichment and a safety net; the Cloud Control sweep is what finds
untagged resources.
asset_type_from_arn(arn) reads service and the resource type from the ARN
(_arn_resource_type: the first path / colon segment, except WAFv2 which uses the segment after
the scope, API Gateway which uses the path shape restapis / restapis/stages, and S3 where the
bare s3 entry only matches bucket ARNs) and looks up service:type, then service, in
catalogs/aws_arn_types.yaml.